topic Re: No response from AWS when pining from CheckPoint in Firewall and Security Management

No response from AWS when pining from CheckPoint

ja123 — Fri, 09 Jul 2021 07:21:43 GMT

The client is using CheckPoint R75.x and we have established a site-to-site VPN Connection. The VPN on our end was setup using AWS.

Were are able to ping from AWS to Checkpoint and receive a response, however, when the client pings from CheckPoint, the packets pass their firewall and into the tunnel but there is no response from AWS side.

The routing and rules are all setup correctly.

We are using 1 tunnel and AWS provides an outside and inside IPv4 cidr for the tunnel. The client used the outside cidr but wasn't sure what to do with the inside cidr. Does the inside cidr need to be added somewhere in CheckPoint?

Is there another step or solution we can take to address the above issue in terms of no receiving a response back?

Re: No response from AWS when pining from CheckPoint

PhoneBoy — Fri, 09 Jul 2021 20:10:54 GMT

R75.x has been End of Support for quite a while and your client should upgrade to a supported release.
The appropriate instructions to configure a VPN to AWS are: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108958&partition=Basic&product=CloudGuard

Re: No response from AWS when pining from CheckPoint

the_rock — Fri, 09 Jul 2021 22:38:35 GMT

What @PhoneBoy sent you is best example of how to configure VPN tunnel with AWS. Disregarding the version, which btw is totally unsupported, did you do any capture on the CP firewall to see why packet is not being received? Maybe do fw monitor, zdebug, try turn off securexl as a test?

Re: No response from AWS when pining from CheckPoint

ja123 — Sun, 11 Jul 2021 23:22:01 GMT

hi,

Thank you for the response. Should have mentioned we are using static routing.

Re: No response from AWS when pining from CheckPoint

PhoneBoy — Mon, 12 Jul 2021 00:29:27 GMT

While I believe it is possible to make it work in that manner it is far from optimal as the AWS VPN endpoint expects redundancy using VTIs and dynamic routing.
We do have an SK for configurations without that, but as noted this is not a recommended configuration: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113840&partition=Advanced&product=IPSec

Re: No response from AWS when pining from CheckPoint

ja123 — Mon, 12 Jul 2021 02:44:14 GMT

Is the inside IPv4 cidr provided by AWS need to be utilised in CheckPoint?

Re: No response from AWS when pining from CheckPoint

PhoneBoy — Mon, 12 Jul 2021 04:04:22 GMT

In this configuration it seems to be: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100726
However, it refers to a later version than you're running.